CVE-2026-98381

In the Linux kernel, bpf_sock_destroy() reads sk_protocol from the wrong structure, causing an out-of-bounds read. The issue affects TIME_WAIT and request sockets passed by the TCP iterator. The fix restricts the sk_protocol check to full sockets only.

In the Linux kernel, LWT_SEG6LOCAL programs can invalidate the cached SRH and then call bpf_skb_pull_data(), leading to a dangling pointer and use-after-free. The fix disallows bpf_skb_pull_data() for LWT_SEG6LOCAL programs.

In the Linux kernel, the BPF device matching mechanism has a flaw that allows a program bound to one device to run on another, leading to memory corruption. The fix restricts non-offloaded programs to exact netdev matches.

In the Linux kernel's net/sched subsystem, a vulnerability exists where tcf_action_delete() fails to check if the IDR lookup result is an error pointer (ERR_PTR). An attacker can exploit a race to replace an action with an error pointer, leading to a null-pointer dereference and kernel panic.

A vulnerability in the Linux kernel's netfilter ip6t_rpfilter module was found, where ip6_route_lookup() can return a route without an inet6_dev (NULL pointer). An unprivileged user can trigger this state by lowering an external interface's MTU below IPV6_MIN_MTU, leading to a NULL pointer dereference and kernel panic.

In the Linux kernel, a vulnerability exists in the BPF link iterator. bpf_link_prime() inserts a link into link_idr before the ID is published, and the link iterator takes a reference without checking whether the link is settled (ID zero). If anon_inode_getfile() fails, the iterator is left with a dangling reference and a subsequent bpf_link_put() accesses freed memory (use-after-free).

In the Linux kernel, __vlan_insert_inner_tag() does not require the MAC header to be present before rewriting it. When a very short frame is sent through an IFF_TUN device, subsequent VLAN push operations can pull uninitialized slab bytes into the frame, leaking kernel memory.

In the Linux kernel, the metadata comparison for percpu array BPF maps used as inner maps does not check max_entries. Replacing an inner map with a smaller one bypasses validation, and the index_mask inlined by the JIT can cause an out-of-bounds access to the pptrs[] array.

In the Linux kernel, the xen/netfront driver does not validate the length of the first RX slot against ETH_HLEN before calling eth_type_trans(). If the first slot is shorter than an Ethernet header, a BUG() may occur in __skb_pull() or the header may be read past the end of the data.

In the Linux kernel, a use-after-free vulnerability exists in tcp_send_synack() involving retransmit_skb_hint. When tcp_send_synack() replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original but tp->retransmit_skb_hint still points to the freed object, which can be exploited by an unprivileged TFO client to trigger a use-after-free.